Under CDM 2015 the principal contractor must take the necessary steps to keep unauthorised people off a construction site and must give everyone a suitable induction. HSE guidance says to keep a record of who is on site and when they arrive and leave, so people can be accounted for in a fire or other emergency. Record only what you need for that purpose, tell visitors why, and delete the record when you no longer need it.
Why do construction sites need to sign visitors in?
Regulation 13(4) of the Construction (Design and Management) Regulations 2015 requires the principal contractor to ensure that “a suitable site induction is provided” and that “the necessary steps are taken to prevent access by unauthorised persons to the construction site”. HSE's guidance, L153, adds that the principal contractor “should also take steps to ensure that only those authorised to access the site do so” (paragraph 135).
HSE's guide to protecting the public, HSG151, is more direct: “Keep a record of who is on site and when they arrive and depart. This helps keep track of people and can be used as an aid for the emergency services in the case of a fire or accident.” It says both visitors and workers should report their presence as soon as they arrive, at a clearly signed control or reporting point (paragraphs 51–52).
Emergency planning depends on the same record. Regulation 30 of CDM 2015 requires arrangements for foreseeable emergencies, including evacuation of the site, that are tested at suitable intervals. HSE's fire safety in construction guidance, HSG168, says people must be able to assemble and be accounted for, for example by a head count. Whoever meets the fire and rescue service should be able to tell them the likely whereabouts of anyone unaccounted for. You can't account for a visitor you didn't know was there. See our guide to running a site muster and roll call.
Who counts as a visitor?
HSG151 says the simple answer to “who do you need to authorise?” is everyone who comes on site. Besides the workforce, it lists:
- people involved in the construction process, such as client representatives, members of the design team, delivery drivers and utility companies;
- people with a statutory right of entry, such as building control officers and HSE or local authority inspectors;
- people who work on the site but not on construction, such as sales and security staff;
- possible future occupiers;
- members of the public, including people who come looking for work.
It helps to set a few visitor types, such as client, consultant, delivery, inspector and interview, so each type sees the right rules and is routed to the right host.
What should you record, and what should you leave out?
A visitor log is personal data, so UK GDPR applies. Its data minimisation principle says personal data must be “adequate, relevant and limited to what is necessary”. The ICO is explicit: “You must not collect personal data on the off-chance that it might be useful in the future.” Start from the purposes, which are safety, security and accounting for people, and work back to the fields.
| Field | Why you might need it | Usually needed? |
|---|---|---|
| Full name | Identify the person on the roll call | Yes |
| Company or organisation | Know who they represent; contact their employer if needed | Yes |
| Who they're visiting (host) | Make sure someone is responsible for them on site | Yes |
| Time in and time out | Know who is on site now | Yes |
| Visitor type | Show the right rules; decide on escorts | Yes |
| Acceptance of site rules | Show the rules were given before entry | Yes |
| Mobile number | Reach them during an evacuation or if they're missing | Often |
| Vehicle registration | Only if they park on site | Sometimes |
| Photo | Badge or identity check on larger or higher-security sites | Only if justified |
| Signature | Only if you rely on a signed acknowledgement | Only if justified |
| ID document number | Rarely justified; check ID without recording it | No |
The ICO's own notice for visitors to its offices is a useful model. Visitors sign in and out and show ID, but “the ID is for verification purposes only; we don't record this information.” The ICO relies on legitimate interests (Article 6(1)(f) of UK GDPR) as its lawful basis for the visitor record.
Two more principles apply. Under the right to be informed, you must give people privacy information at the time you collect their data, covering what you'll use it for, how long you'll keep it and your lawful basis. A short notice at the point of sign-in, with a link to the full version, does that. Under storage limitation, you should set a retention period for visitor records and delete or anonymise them when it ends.
Site rules, induction and PPE
L153 says site inductions should also be given to occasional and one-off visitors, in proportion to the nature of the visit. “Inductions provided to escorted visitors need not have the detail that unescorted visitors should have. Escorted visitors only need to be made aware of the main hazards they may be exposed to and the control measures” (paragraph 134).
For fire, HSG168 sets a minimum that everyone must be given on their first day on site, “even if they are there for just a few hours”:
- the location and use of escape routes from their work area, and the assembly points;
- the location and operation of the fire alarm point in their working area;
- any significant fire hazard in their area of work.
HSG151 says risk assessments should identify the PPE visitors need, such as safety boots, high-visibility clothing and safety helmets, and that sites should keep spare PPE for known or likely visitors (paragraph 56). Put the essentials in the rules visitors accept at sign-in: PPE, where they may and may not go, reporting to their host, and what to do when the alarm sounds.
Escorts, hosts and badges
HSG151 says not to let visitors walk around unaccompanied unless they are familiar with the site and its risks. On a large or complex site, or where the risk is significant, a visitor may need to be accompanied at all times (paragraphs 51 and 55). In practice:
- Escort by default for anyone without a full induction: clients, consultants on a first visit, prospective occupiers and the public.
- Unescorted access only for visitors who have had the full site induction and need to move around, such as regular consultants or inspectors.
- Delivery drivers: decide where they wait and unload under the site's traffic plan, and whether they may leave the vehicle.
Tell the host as soon as their visitor arrives, so nobody waits unescorted at the gate. HSG151 also suggests giving out some means of identification at the control point, such as a badge or a distinctive coloured hard hat, so anyone can see quickly whether a person is authorised to be there (paragraph 53).
Signing out and the muster
A sign-in record is only useful in an emergency if people also sign out. If a visitor leaves without signing out, the roll call shows them as missing, and someone may go back into a building to look for them. Make signing out as easy as signing in, and have hosts confirm their visitors have left. At the end of the day, follow up anyone still shown as on site.
Visitors should appear on the same list as workers when the alarm sounds, so the person running the roll call has one list rather than several.
Should you use a paper book or a kiosk?
HSG151 accepts that on smaller sites “it may be enough for visitors to sign into the site log book and report to the site manager”, while a large site might use passes or swipe cards. Choose the method that fits the size and risk of the site.
A paper book has drawbacks that are worth knowing about. Each new visitor can read the names, companies and times of everyone above them. Handwriting can be hard to read during a roll call. The book only exists in one place, and it is hard to apply a retention period to it. A digital sign-in can show the minimum on screen, give the privacy notice at the point of collection, alert the host, delete records on a schedule and feed the muster list directly. Whichever you use, keep a fallback for when the power or the network is down.
How Assured Contractors helps
Each site gets its own visitor kiosk link and QR poster. Visitors sign in on a reception tablet or their own phone, with no app to install. They choose a visitor type, accept your site rules and, if you ask, add a photo and signature. Their host is notified and a badge can be printed. Pre-registered visitors use a 6-character code. Visitors sign out from the kiosk list, which shows only first name and initial, or on the same phone, and they appear on site access and the emergency muster. Visitors don't need an account or an app, and contractors use Assured Contractors free. See the visitor sign-in kiosk and site access and muster.
Questions
Is it a legal requirement to sign visitors in on a construction site?
CDM 2015 requires the principal contractor to take the necessary steps to prevent unauthorised access and to provide suitable site inductions, and to have emergency arrangements including evacuation. The law doesn't prescribe a visitor book as such, but HSE's guidance (HSG151) says to keep a record of who is on site and when they arrive and leave, and a sign-in record is the usual way to do it.
Do visitors need a full site induction?
Not always. HSE's L153 guidance says visitor inductions should be proportionate to the nature of the visit. Escorted visitors only need to know the main hazards they may be exposed to and the controls, while unescorted visitors need more detail. Everyone must be told about escape routes, assembly points, fire alarm points and significant fire hazards on their first day.
Can we take visitors' photos at sign-in?
Only if you can justify it. Under UK GDPR's data minimisation principle you should collect only what is necessary for your purpose. A photo can be justified for badges on larger or higher-security sites. Tell visitors why you take it and how long you keep it.
How long should we keep visitor records?
UK GDPR doesn't set a fixed period. The storage limitation principle says to keep personal data no longer than you need it, and the ICO says to set and document retention periods, then delete or anonymise records when they end. Base the period on why you keep the records, for example investigating incidents, and state it in your privacy notice.
Who should have to be escorted?
HSE's HSG151 says visitors shouldn't walk around unaccompanied unless they are familiar with the site and the risks, and that on large or complex sites, or where risks are significant, visitors may need to be accompanied at all times. A simple rule is to escort anyone who hasn't had the full site induction.
Sources
Checked 11 November 2026. Legislation links go to legislation.gov.uk; guidance links to the publisher's own pages.
- Construction (Design and Management) Regulations 2015, regulation 13 (legislation.gov.uk)
- Construction (Design and Management) Regulations 2015, regulation 30 (legislation.gov.uk)
- HSE L153: Managing health and safety in construction (PDF)
- HSE HSG151: Protecting the public, your next move (PDF)
- HSE HSG168: Fire safety in construction (third edition, 2022)
- ICO: Data minimisation
- ICO: Storage limitation
- ICO: Right to be informed
- ICO: Privacy notice for visitors to the office
This guide is general information, not legal advice. Check the current legislation and guidance for your own site and work.